GHSA-x752-qjv4-c4hccritical9.8
Remote code injection in dompdf/dompdf
Impact
Dompdf is an HTML to PDF converter. Dompdf before 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
dompdf/dompdf Packagist
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 1.2.1Ecosystem versions | 1.2.1 |
Version evidence: OSV · GHSA-x752-qjv4-c4hc
View original version evidence (20 explicit versions)
Original source description
Dompdf is an HTML to PDF converter. Dompdf before 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2022-28368
- Source reference github.com/dompdf/dompdf/issues/2598
- Patch github.com/dompdf/dompdf/pull/2808
- Patch github.com/dompdf/dompdf/commit/4c70e1025bcd9b7694b95dd552499bd83cd6141d
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/dompdf/dompdf/CVE-2022-28368.yaml
- Security advisory github.com/advisories/GHSA-x752-qjv4-c4hc
- Source reference github.com/dompdf/dompdf
- Source reference github.com/snyk-labs/php-goof
- Source reference packagist.org/packages/dompdf/dompdf
- Security advisory snyk.io/blog/security-alert-php-pdf-library-dompdf-rce
- Public exploit reference packetstormsecurity.com/files/171738/Dompdf-1.2.1-Remote-Code-Execution.html